@ebowwa/hetzner 0.1.0 → 0.2.0

package/auth.js

@@ -1,15 +1,20 @@
+"use strict";
 /**
  * Hetzner authentication utilities
  */
-import { readFileSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-export function getTokenFromCLI() {
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTokenFromCLI = getTokenFromCLI;
+exports.isAuthenticated = isAuthenticated;
+exports.resolveApiToken = resolveApiToken;
+var node_fs_1 = require("node:fs");
+var node_path_1 = require("node:path");
+var node_os_1 = require("node:os");
+function getTokenFromCLI() {
     try {
-        const configPath = join(homedir(), ".config", "hcloud", "cli.toml");
-        if (existsSync(configPath)) {
-            const config = readFileSync(configPath, "utf-8");
-            const match = config.match(/token\s*=\s*["']([^"']+)["']/);
+        var configPath = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "hcloud", "cli.toml");
+        if ((0, node_fs_1.existsSync)(configPath)) {
+            var config = (0, node_fs_1.readFileSync)(configPath, "utf-8");
+            var match = config.match(/token\s*=\s*["']([^"']+)["']/);
             if (match && match[1]) {
                 return match[1];
             }
@@ -20,10 +25,10 @@ export function getTokenFromCLI() {
     }
     return "";
 }
-export function isAuthenticated(apiToken) {
+function isAuthenticated(apiToken) {
     return apiToken.length > 0;
 }
-export function resolveApiToken(explicitToken) {
+function resolveApiToken(explicitToken) {
     if (explicitToken) {
         return explicitToken;
     }
@@ -32,4 +37,3 @@ export function resolveApiToken(explicitToken) {
     }
     return getTokenFromCLI();
 }
-//# sourceMappingURL=auth.js.map

package/bootstrap/cloud-init.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Cloud-Init Bootstrap Generator
  *
@@ -11,19 +12,33 @@
  * 3. SSH Hardening (service-level hardening)
  * 4. Security Audit (verification and reporting)
  */
-import { sshdHardeningPackages, sshdHardeningWriteFiles, sshdHardeningRunCmd, } from "./ssh-hardening";
-import { ufwFirewallPackages, ufwFirewallWriteFiles, ufwFirewallRunCmd, DEFAULT_UFW_WORKER_OPTIONS, } from "./firewall";
-import { kernelHardeningPackages, kernelHardeningWriteFiles, kernelHardeningRunCmd, } from "./kernel-hardening";
-import { securityAuditPackages, securityAuditWriteFiles, securityAuditRunCmd, } from "./security-audit";
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityAuditRunCmd = exports.securityAuditWriteFiles = exports.securityAuditPackages = exports.kernelHardeningRunCmd = exports.kernelHardeningWriteFiles = exports.kernelHardeningPackages = exports.generateUFWFirewallForWorker = exports.generateUFWFirewallForGenesis = exports.DEFAULT_UFW_GENESIS_OPTIONS = exports.DEFAULT_UFW_WORKER_OPTIONS = exports.ufwFirewallRunCmd = exports.ufwFirewallWriteFiles = exports.ufwFirewallPackages = exports.sshdHardeningRunCmd = exports.sshdHardeningWriteFiles = exports.sshdHardeningPackages = exports.GenesisBootstrapPresets = exports.generateRemoteGenesisBootstrap = exports.generateGenesisBootstrap = exports.BootstrapPresets = void 0;
+exports.generateSeedBootstrap = generateSeedBootstrap;
+exports.generateRemoteBootstrap = generateRemoteBootstrap;
+var ssh_hardening_1 = require("./ssh-hardening");
+var firewall_1 = require("./firewall");
+var kernel_hardening_1 = require("./kernel-hardening");
+var security_audit_1 = require("./security-audit");
 /**
  * Generate a cloud-init YAML script for seed installation
  *
  * @param options - Bootstrap configuration options
  * @returns Cloud-init YAML string
  */
-export function generateSeedBootstrap(options = {}) {
-    const { seedRepo = "https://github.com/ebowwa/seed", seedBranch = "dev", seedPath = "/root/seed", runSetup = true, setupEnv = {}, packages = [], additionalCommands = [], enableSecurity = true, } = options;
-    const lines = [];
+function generateSeedBootstrap(options) {
+    if (options === void 0) { options = {}; }
+    var _a = options.seedRepo, seedRepo = _a === void 0 ? "https://github.com/ebowwa/seed" : _a, _b = options.seedBranch, seedBranch = _b === void 0 ? "dev" : _b, _c = options.seedPath, seedPath = _c === void 0 ? "/root/seed" : _c, _d = options.runSetup, runSetup = _d === void 0 ? true : _d, _e = options.setupEnv, setupEnv = _e === void 0 ? {} : _e, _f = options.packages, packages = _f === void 0 ? [] : _f, _g = options.additionalCommands, additionalCommands = _g === void 0 ? [] : _g, _h = options.enableSecurity, enableSecurity = _h === void 0 ? true : _h;
+    var lines = [];
     // Cloud-config header
     lines.push("#cloud-config");
     lines.push("");
@@ -43,26 +58,27 @@ export function generateSeedBootstrap(options = {}) {
     // Security Module 1: UFW Firewall packages
     if (enableSecurity) {
         lines.push("  # Security: UFW Firewall");
-        lines.push(...ufwFirewallPackages());
+        lines.push.apply(lines, (0, firewall_1.ufwFirewallPackages)());
     }
     // Security Module 2: Kernel hardening packages
     if (enableSecurity) {
         lines.push("  # Security: Kernel hardening");
-        lines.push(...kernelHardeningPackages());
+        lines.push.apply(lines, (0, kernel_hardening_1.kernelHardeningPackages)());
     }
     // Security Module 3: SSH hardening packages (fail2ban)
     if (enableSecurity) {
         lines.push("  # Security: SSH hardening");
-        lines.push(...sshdHardeningPackages());
+        lines.push.apply(lines, (0, ssh_hardening_1.sshdHardeningPackages)());
     }
     // Security Module 4: Security audit packages (lynis)
     if (enableSecurity) {
         lines.push("  # Security: Security audit");
-        lines.push(...securityAuditPackages());
+        lines.push.apply(lines, (0, security_audit_1.securityAuditPackages)());
     }
     // Add additional packages
-    for (const pkg of packages) {
-        lines.push(`  - ${pkg}`);
+    for (var _i = 0, packages_1 = packages; _i < packages_1.length; _i++) {
+        var pkg = packages_1[_i];
+        lines.push("  - ".concat(pkg));
     }
     lines.push("");
     // Status tracking file
@@ -93,22 +109,22 @@ export function generateSeedBootstrap(options = {}) {
     // Security Module 1: UFW Firewall configuration files
     if (enableSecurity) {
         lines.push("  # Security Module 1: UFW Firewall configuration");
-        lines.push(...ufwFirewallWriteFiles(DEFAULT_UFW_WORKER_OPTIONS));
+        lines.push.apply(lines, (0, firewall_1.ufwFirewallWriteFiles)(firewall_1.DEFAULT_UFW_WORKER_OPTIONS));
     }
     // Security Module 2: Kernel hardening configuration files
     if (enableSecurity) {
         lines.push("  # Security Module 2: Kernel hardening");
-        lines.push(...kernelHardeningWriteFiles());
+        lines.push.apply(lines, (0, kernel_hardening_1.kernelHardeningWriteFiles)());
     }
     // Security Module 3: SSH hardening configuration files
     if (enableSecurity) {
         lines.push("  # Security Module 3: SSH hardening");
-        lines.push(...sshdHardeningWriteFiles());
+        lines.push.apply(lines, (0, ssh_hardening_1.sshdHardeningWriteFiles)());
     }
     // Security Module 4: Security audit script
     if (enableSecurity) {
         lines.push("  # Security Module 4: Security audit");
-        lines.push(...securityAuditWriteFiles());
+        lines.push.apply(lines, (0, security_audit_1.securityAuditWriteFiles)());
     }
     // Node-agent systemd service
     lines.push("  # Node-agent systemd service for Ralph Loop orchestration");
@@ -125,9 +141,9 @@ export function generateSeedBootstrap(options = {}) {
     lines.push("      [Service]");
     lines.push("      Type=simple");
     lines.push("      User=root");
-    lines.push(`      WorkingDirectory=${seedPath}/node-agent`);
+    lines.push("      WorkingDirectory=".concat(seedPath, "/node-agent"));
     lines.push("      ExecStart=/root/.bun/bin/bun run src/index.ts");
-    lines.push(`      EnvironmentFile=-${seedPath}/node-agent/.env`);
+    lines.push("      EnvironmentFile=-".concat(seedPath, "/node-agent/.env"));
     lines.push("      Environment=PORT=8911");
     lines.push("      Restart=always");
     lines.push("      RestartSec=10");
@@ -158,55 +174,59 @@ export function generateSeedBootstrap(options = {}) {
     lines.push("  - ln -sf /root/.bun/bin/bun /root/.bun/bin/node  # Create 'node' symlink to bun");
     lines.push("");
     // Clone seed repository
-    lines.push(`  # Clone seed repository`);
-    lines.push(`  - git clone --depth 1 --branch ${seedBranch} ${seedRepo} ${seedPath}`);
+    lines.push("  # Clone seed repository");
+    lines.push("  - git clone --depth 1 --branch ".concat(seedBranch, " ").concat(seedRepo, " ").concat(seedPath));
     lines.push("");
     if (runSetup) {
         // Build environment variables
-        const envVars = ["NONINTERACTIVE=1", ...Object.entries(setupEnv).map(([k, v]) => `${k}=${v}`)];
-        const envString = envVars.join(" ");
-        lines.push(`  # Run seed setup non-interactively`);
-        lines.push(`  - cd ${seedPath} && ${envString} bash ./setup.sh 2>&1 | tee /var/log/seed-setup.log`);
+        var envVars = __spreadArray(["NONINTERACTIVE=1"], Object.entries(setupEnv).map(function (_a) {
+            var k = _a[0], v = _a[1];
+            return "".concat(k, "=").concat(v);
+        }), true);
+        var envString = envVars.join(" ");
+        lines.push("  # Run seed setup non-interactively");
+        lines.push("  - cd ".concat(seedPath, " && ").concat(envString, " bash ./setup.sh 2>&1 | tee /var/log/seed-setup.log"));
         lines.push("");
         // Create completion marker
-        lines.push(`  # Mark setup complete`);
-        lines.push(`  - touch ${seedPath}/.seed-setup-complete`);
+        lines.push("  # Mark setup complete");
+        lines.push("  - touch ".concat(seedPath, "/.seed-setup-complete"));
         lines.push("");
     }
     // Additional commands
     if (additionalCommands.length > 0) {
-        lines.push(`  # Additional custom commands`);
-        for (const cmd of additionalCommands) {
-            lines.push(`  - ${cmd}`);
+        lines.push("  # Additional custom commands");
+        for (var _j = 0, additionalCommands_1 = additionalCommands; _j < additionalCommands_1.length; _j++) {
+            var cmd = additionalCommands_1[_j];
+            lines.push("  - ".concat(cmd));
         }
         lines.push("");
     }
     // Security Module 1: UFW Firewall activation (runs first)
     if (enableSecurity) {
         lines.push("  # Security Module 1: Activate UFW Firewall");
-        lines.push(...ufwFirewallRunCmd(DEFAULT_UFW_WORKER_OPTIONS));
+        lines.push.apply(lines, (0, firewall_1.ufwFirewallRunCmd)(firewall_1.DEFAULT_UFW_WORKER_OPTIONS));
     }
     // Security Module 2: Kernel hardening activation
     if (enableSecurity) {
         lines.push("  # Security Module 2: Apply kernel hardening");
-        lines.push(...kernelHardeningRunCmd());
+        lines.push.apply(lines, (0, kernel_hardening_1.kernelHardeningRunCmd)());
     }
     // Security Module 3: SSH hardening activation
     if (enableSecurity) {
         lines.push("  # Security Module 3: Activate SSH hardening");
-        lines.push(...sshdHardeningRunCmd());
+        lines.push.apply(lines, (0, ssh_hardening_1.sshdHardeningRunCmd)());
     }
     // Security Module 4: Security audit (runs last)
     if (enableSecurity) {
         lines.push("  # Security Module 4: Run security audit");
-        lines.push(...securityAuditRunCmd());
+        lines.push.apply(lines, (0, security_audit_1.securityAuditRunCmd)());
     }
     // Mark bootstrap complete
-    lines.push(`  # Mark bootstrap complete`);
-    lines.push(`  - echo "status=complete" >> /root/.bootstrap-status`);
-    lines.push(`  - echo "completed_at=$(date -Iseconds)" >> /root/.bootstrap-status`);
+    lines.push("  # Mark bootstrap complete");
+    lines.push("  - echo \"status=complete\" >> /root/.bootstrap-status");
+    lines.push("  - echo \"completed_at=$(date -Iseconds)\" >> /root/.bootstrap-status");
     if (enableSecurity) {
-        lines.push(`  - echo "security_hardening=applied" >> /root/.bootstrap-status`);
+        lines.push("  - echo \"security_hardening=applied\" >> /root/.bootstrap-status");
     }
     lines.push("");
     lines.push("  # Start node-agent service");
@@ -224,56 +244,80 @@ export function generateSeedBootstrap(options = {}) {
  * @param url - URL to fetch the cloud-init config from
  * @returns Cloud-init YAML string with #include directive
  */
-export function generateRemoteBootstrap(url) {
-    return `#include\n${url}`;
+function generateRemoteBootstrap(url) {
+    return "#include\n".concat(url);
 }
 /**
  * Bootstrap configuration presets for common scenarios
  */
-export const BootstrapPresets = {
+exports.BootstrapPresets = {
     /**
      * Default seed installation with setup.sh and full security hardening
      */
-    default: () => generateSeedBootstrap(),
+    default: function () { return generateSeedBootstrap(); },
     /**
      * Seed installation with full security hardening and verbose logging
      */
-    secure: () => generateSeedBootstrap({
-        setupEnv: {
-            DEBUG: "1",
-            VERBOSE: "1",
-        },
-    }),
+    secure: function () {
+        return generateSeedBootstrap({
+            setupEnv: {
+                DEBUG: "1",
+                VERBOSE: "1",
+            },
+        });
+    },
     /**
      * Seed installation without running setup.sh (useful for debugging)
      */
-    cloneOnly: () => generateSeedBootstrap({ runSetup: false }),
+    cloneOnly: function () { return generateSeedBootstrap({ runSetup: false }); },
     /**
      * Development bootstrap without security hardening (for testing)
      */
-    development: () => generateSeedBootstrap({
-        enableSecurity: false,
-        packages: ["htop", "vim", "strace"],
-    }),
+    development: function () {
+        return generateSeedBootstrap({
+            enableSecurity: false,
+            packages: ["htop", "vim", "strace"],
+        });
+    },
     /**
      * Verbose bootstrap with logging enabled
      */
-    verbose: () => generateSeedBootstrap({
-        setupEnv: {
-            DEBUG: "1",
-            VERBOSE: "1",
-        },
-    }),
+    verbose: function () {
+        return generateSeedBootstrap({
+            setupEnv: {
+                DEBUG: "1",
+                VERBOSE: "1",
+            },
+        });
+    },
 };
 // Re-export Genesis bootstrap functions
-export { generateGenesisBootstrap, generateRemoteGenesisBootstrap, GenesisBootstrapPresets, } from "./genesis";
+var genesis_1 = require("./genesis");
+Object.defineProperty(exports, "generateGenesisBootstrap", { enumerable: true, get: function () { return genesis_1.generateGenesisBootstrap; } });
+Object.defineProperty(exports, "generateRemoteGenesisBootstrap", { enumerable: true, get: function () { return genesis_1.generateRemoteGenesisBootstrap; } });
+Object.defineProperty(exports, "GenesisBootstrapPresets", { enumerable: true, get: function () { return genesis_1.GenesisBootstrapPresets; } });
 // Re-export SSH hardening components so callers can compose custom
 // cloud-init scripts with hardening baked in (e.g. for non-standard node types)
-export { sshdHardeningPackages, sshdHardeningWriteFiles, sshdHardeningRunCmd, } from "./ssh-hardening";
+var ssh_hardening_2 = require("./ssh-hardening");
+Object.defineProperty(exports, "sshdHardeningPackages", { enumerable: true, get: function () { return ssh_hardening_2.sshdHardeningPackages; } });
+Object.defineProperty(exports, "sshdHardeningWriteFiles", { enumerable: true, get: function () { return ssh_hardening_2.sshdHardeningWriteFiles; } });
+Object.defineProperty(exports, "sshdHardeningRunCmd", { enumerable: true, get: function () { return ssh_hardening_2.sshdHardeningRunCmd; } });
 // Re-export UFW firewall components
-export { ufwFirewallPackages, ufwFirewallWriteFiles, ufwFirewallRunCmd, DEFAULT_UFW_WORKER_OPTIONS, DEFAULT_UFW_GENESIS_OPTIONS, generateUFWFirewallForGenesis, generateUFWFirewallForWorker, } from "./firewall";
+var firewall_2 = require("./firewall");
+Object.defineProperty(exports, "ufwFirewallPackages", { enumerable: true, get: function () { return firewall_2.ufwFirewallPackages; } });
+Object.defineProperty(exports, "ufwFirewallWriteFiles", { enumerable: true, get: function () { return firewall_2.ufwFirewallWriteFiles; } });
+Object.defineProperty(exports, "ufwFirewallRunCmd", { enumerable: true, get: function () { return firewall_2.ufwFirewallRunCmd; } });
+Object.defineProperty(exports, "DEFAULT_UFW_WORKER_OPTIONS", { enumerable: true, get: function () { return firewall_2.DEFAULT_UFW_WORKER_OPTIONS; } });
+Object.defineProperty(exports, "DEFAULT_UFW_GENESIS_OPTIONS", { enumerable: true, get: function () { return firewall_2.DEFAULT_UFW_GENESIS_OPTIONS; } });
+Object.defineProperty(exports, "generateUFWFirewallForGenesis", { enumerable: true, get: function () { return firewall_2.generateUFWFirewallForGenesis; } });
+Object.defineProperty(exports, "generateUFWFirewallForWorker", { enumerable: true, get: function () { return firewall_2.generateUFWFirewallForWorker; } });
 // Re-export kernel hardening components
-export { kernelHardeningPackages, kernelHardeningWriteFiles, kernelHardeningRunCmd, } from "./kernel-hardening";
+var kernel_hardening_2 = require("./kernel-hardening");
+Object.defineProperty(exports, "kernelHardeningPackages", { enumerable: true, get: function () { return kernel_hardening_2.kernelHardeningPackages; } });
+Object.defineProperty(exports, "kernelHardeningWriteFiles", { enumerable: true, get: function () { return kernel_hardening_2.kernelHardeningWriteFiles; } });
+Object.defineProperty(exports, "kernelHardeningRunCmd", { enumerable: true, get: function () { return kernel_hardening_2.kernelHardeningRunCmd; } });
 // Re-export security audit components
-export { securityAuditPackages, securityAuditWriteFiles, securityAuditRunCmd, } from "./security-audit";
-//# sourceMappingURL=cloud-init.js.map
+var security_audit_2 = require("./security-audit");
+Object.defineProperty(exports, "securityAuditPackages", { enumerable: true, get: function () { return security_audit_2.securityAuditPackages; } });
+Object.defineProperty(exports, "securityAuditWriteFiles", { enumerable: true, get: function () { return security_audit_2.securityAuditWriteFiles; } });
+Object.defineProperty(exports, "securityAuditRunCmd", { enumerable: true, get: function () { return security_audit_2.securityAuditRunCmd; } });

package/bootstrap/firewall.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * UFW Firewall Cloud-Init Components
  *
@@ -24,10 +25,17 @@
  *   - Tailscale (41641): allowed for VPN
  *   - Logging: enabled with rate limiting to prevent log flooding
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_UFW_WORKER_OPTIONS = exports.DEFAULT_UFW_GENESIS_OPTIONS = void 0;
+exports.ufwFirewallPackages = ufwFirewallPackages;
+exports.ufwFirewallWriteFiles = ufwFirewallWriteFiles;
+exports.ufwFirewallRunCmd = ufwFirewallRunCmd;
+exports.generateUFWFirewallForGenesis = generateUFWFirewallForGenesis;
+exports.generateUFWFirewallForWorker = generateUFWFirewallForWorker;
 /**
  * Default firewall options for Genesis control plane servers.
  */
-export const DEFAULT_UFW_GENESIS_OPTIONS = {
+exports.DEFAULT_UFW_GENESIS_OPTIONS = {
     allowSSHFrom: [], // Empty = allow from anywhere
     allowHTTP: true,
     allowHTTPS: true,
@@ -37,7 +45,7 @@ export const DEFAULT_UFW_GENESIS_OPTIONS = {
 /**
  * Default firewall options for worker/seed servers.
  */
-export const DEFAULT_UFW_WORKER_OPTIONS = {
+exports.DEFAULT_UFW_WORKER_OPTIONS = {
     allowSSHFrom: [], // Empty = allow from anywhere
     allowHTTP: false,
     allowHTTPS: false,
@@ -50,7 +58,7 @@ export const DEFAULT_UFW_WORKER_OPTIONS = {
  *
  * - ufw: Uncomplicated Firewall interface to iptables/nftables
  */
-export function ufwFirewallPackages() {
+function ufwFirewallPackages() {
     return [
         "  - ufw",
     ];
@@ -72,8 +80,9 @@ export function ufwFirewallPackages() {
  *    - ICMP redirect protection
  *    - Log martian packets
  */
-export function ufwFirewallWriteFiles(options = {}) {
-    const lines = [];
+function ufwFirewallWriteFiles(options) {
+    if (options === void 0) { options = {}; }
+    var lines = [];
     // 1. UFW before.rules - stateful firewall rules applied before UFW rules
     lines.push("  # UFW before.rules - stateful firewall and network security");
     lines.push("  - path: /etc/ufw/before.rules");
@@ -167,9 +176,10 @@ export function ufwFirewallWriteFiles(options = {}) {
  *   8. Enable and reload UFW
  *   9. Display firewall status
  */
-export function ufwFirewallRunCmd(options = {}) {
-    const { allowSSHFrom = [], allowHTTP = true, allowHTTPS = true, allowNodeAgent = false, additionalPorts = [], verboseLogging = false, } = options;
-    const lines = [];
+function ufwFirewallRunCmd(options) {
+    if (options === void 0) { options = {}; }
+    var _a = options.allowSSHFrom, allowSSHFrom = _a === void 0 ? [] : _a, _b = options.allowHTTP, allowHTTP = _b === void 0 ? true : _b, _c = options.allowHTTPS, allowHTTPS = _c === void 0 ? true : _c, _d = options.allowNodeAgent, allowNodeAgent = _d === void 0 ? false : _d, _e = options.additionalPorts, additionalPorts = _e === void 0 ? [] : _e, _f = options.verboseLogging, verboseLogging = _f === void 0 ? false : _f;
+    var lines = [];
     lines.push("  # UFW Firewall: Configure and enable secure firewall");
     lines.push("");
     // Set default policies
@@ -191,8 +201,9 @@ export function ufwFirewallRunCmd(options = {}) {
     }
     else {
         // Allow SSH from specific IPs/CIDRs
-        for (const source of allowSSHFrom) {
-            lines.push(`  - ufw allow from ${source} to any port 22 proto tcp comment 'SSH from ${source}'`);
+        for (var _i = 0, allowSSHFrom_1 = allowSSHFrom; _i < allowSSHFrom_1.length; _i++) {
+            var source = allowSSHFrom_1[_i];
+            lines.push("  - ufw allow from ".concat(source, " to any port 22 proto tcp comment 'SSH from ").concat(source, "'"));
         }
     }
     lines.push("");
@@ -220,10 +231,11 @@ export function ufwFirewallRunCmd(options = {}) {
     // Additional ports
     if (additionalPorts.length > 0) {
         lines.push("  # Additional custom ports");
-        for (const portConfig of additionalPorts) {
-            const protocol = portConfig.protocol || "tcp";
-            const comment = portConfig.comment || `Custom port ${portConfig.port}`;
-            lines.push(`  - ufw allow ${portConfig.port}/${protocol} comment '${comment}'`);
+        for (var _g = 0, additionalPorts_1 = additionalPorts; _g < additionalPorts_1.length; _g++) {
+            var portConfig = additionalPorts_1[_g];
+            var protocol = portConfig.protocol || "tcp";
+            var comment = portConfig.comment || "Custom port ".concat(portConfig.port);
+            lines.push("  - ufw allow ".concat(portConfig.port, "/").concat(protocol, " comment '").concat(comment, "'"));
         }
         lines.push("");
     }
@@ -256,7 +268,8 @@ export function ufwFirewallRunCmd(options = {}) {
  * @param options - UFW firewall options (uses DEFAULT_UFW_GENESIS_OPTIONS if not provided)
  * @returns Object with packages, writeFiles, and runCmd arrays
  */
-export function generateUFWFirewallForGenesis(options = DEFAULT_UFW_GENESIS_OPTIONS) {
+function generateUFWFirewallForGenesis(options) {
+    if (options === void 0) { options = exports.DEFAULT_UFW_GENESIS_OPTIONS; }
     return {
         packages: ufwFirewallPackages(),
         writeFiles: ufwFirewallWriteFiles(options),
@@ -269,11 +282,11 @@ export function generateUFWFirewallForGenesis(options = DEFAULT_UFW_GENESIS_OPTI
  * @param options - UFW firewall options (uses DEFAULT_UFW_WORKER_OPTIONS if not provided)
  * @returns Object with packages, writeFiles, and runCmd arrays
  */
-export function generateUFWFirewallForWorker(options = DEFAULT_UFW_WORKER_OPTIONS) {
+function generateUFWFirewallForWorker(options) {
+    if (options === void 0) { options = exports.DEFAULT_UFW_WORKER_OPTIONS; }
     return {
         packages: ufwFirewallPackages(),
         writeFiles: ufwFirewallWriteFiles(options),
         runCmd: ufwFirewallRunCmd(options),
     };
 }
-//# sourceMappingURL=firewall.js.map